https://community.splunk.com/t5/Splunk-Search/How-do-I-simulate-doing-a-left-join-or-outer-join-using-the-quot/m-p/218058#M64091 <P>you can try to use <CODE>...|appendpipe [stats count by clusterTitle |join max=0 clusterTitle [|inputlookup clusterTable.csv]|fields - count]|stats values(*) by clusterTitle</CODE></P> <P>or something along those lines. Without knowing your actual syntax/data, that's the best I got.</P> Fri, 11 Nov 2016 19:58:04 GMT cmerriman 2016-11-11T19:58:04Z https://community.splunk.com/t5/Splunk-Search/How-do-I-simulate-doing-a-left-join-or-outer-join-using-the-quot/m-p/218057#M64090 <P>Issue I am running into right now is I have a result set that I want to pull in threshold values that reside in a lookup CSV file. I am looking up based on a cluster title field, but ideally, what I want to happen is for every single cluster title in this lookup file to produce a row, even if there were no results in my actual search for that cluster. Is there a way I can do this?</P> Fri, 11 Nov 2016 19:42:35 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-simulate-doing-a-left-join-or-outer-join-using-the-quot/m-p/218057#M64090 bcronrath 2016-11-11T19:42:35Z https://community.splunk.com/t5/Splunk-Search/How-do-I-simulate-doing-a-left-join-or-outer-join-using-the-quot/m-p/218058#M64091 <P>you can try to use <CODE>...|appendpipe [stats count by clusterTitle |join max=0 clusterTitle [|inputlookup clusterTable.csv]|fields - count]|stats values(*) by clusterTitle</CODE></P> <P>or something along those lines. Without knowing your actual syntax/data, that's the best I got.</P> Fri, 11 Nov 2016 19:58:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-simulate-doing-a-left-join-or-outer-join-using-the-quot/m-p/218058#M64091 cmerriman 2016-11-11T19:58:04Z https://community.splunk.com/t5/Splunk-Search/How-do-I-simulate-doing-a-left-join-or-outer-join-using-the-quot/m-p/218059#M64092 <P>Try like this (assuming your current search gives a results set with unique values of field cluster_title)</P> <PRE><CODE>your current search giving result with fields cluster_title and others | append [| inputlookup yourlookup.csv | table cluster_title ] | stats values(*) as * by cluster_title </CODE></PRE> Fri, 11 Nov 2016 20:54:39 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-simulate-doing-a-left-join-or-outer-join-using-the-quot/m-p/218059#M64092 somesoni2 2016-11-11T20:54:39Z https://community.splunk.com/t5/Splunk-Search/How-do-I-simulate-doing-a-left-join-or-outer-join-using-the-quot/m-p/218060#M64093 <P>works perfectly thank you so much!</P> Fri, 11 Nov 2016 23:30:44 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-simulate-doing-a-left-join-or-outer-join-using-the-quot/m-p/218060#M64093 bcronrath 2016-11-11T23:30:44Z